KR102548900B1 - Method and apparatus for installing a trusted application on electronic device - Google Patents

Abstract

Acquire an application package for installing the application, determine whether the application package includes a trusted application that can be installed on the electronic device, and if the application package includes a trusted application, install the trusted application on the electronic device. Disclosed is a method of installing an application to an electronic device, wherein the application to be installed is installed on the electronic device.

Description

Method and apparatus for installing a trusted application on electronic device {Method and apparatus for installing a trusted application on electronic device}

The present disclosure relates to a method and apparatus for installing a trusted application (TA) in an electronic device.

A typical mobile application or app is executed based on a mobile operating system (OS). Since running applications can be isolated from each other by the kernel of an operating system, security of applications can be guaranteed to some extent. However, the security of applications is dependent on the operating system being able to be corrupted by malware. Therefore, applications dealing with sensitive and personal data require a higher security level.

A trusted application is an application that provides security services to an application running on a normal OS, such as a mobile banking application. An application can increase its security level by using a trusted application.

Trusted applications can be distributed and managed to client devices through a server-based system called Trusted Services Manager (TSM). However, server-based systems such as TSM can take a long time to deploy, can be expensive to set up, and can generate overhead to manage. Therefore, a more convenient mechanism for distributing and managing trusted applications is needed.

The present disclosure relates to a method of installing a trusted application in an electronic device, and more particularly, to a method of installing a trusted application in an electronic device using a method of distributing and installing an existing application.

A method of installing an application in an electronic device according to an embodiment includes obtaining an application package for installing the application; determining whether the application package includes a trusted application that can be installed on the electronic device; and if the application package includes the trusted application, installing the trusted application to the electronic device.

In the installing step, when the application package includes a plurality of trusted applications corresponding to different types of security areas, they are installed in the security area of the electronic device based on the type of the security area of the electronic device. selecting an available trusted application; and installing the selected trusted application in a secure area of the electronic device.

determining whether the application package contains trusted applications that can be installed on other electronic devices; and when the application package includes a trusted application that can be installed in the other electronic device, transmitting the trusted application to the other electronic device.

extracting a second application package that can be installed in the other electronic device from the application package; and transmitting the extracted second application package to the other electronic device.

The other electronic device includes a wearable electronic device paired with the electronic device.

The determining may include obtaining a flag value indicating whether the trusted application is included in the application package; and determining whether the application package includes a trusted application that can be installed in a secure area of the electronic device, based on the obtained flag value.

An electronic device in which an application is installed according to an embodiment includes a network interface for obtaining an application package for installing the application; Determine whether the application package includes a trusted application that can be installed in the electronic device, and if the application package includes the trusted application, install the trusted application in the electronic device. It includes a processor that

A method of distributing an application to an electronic device according to an embodiment includes acquiring a normal application to be installed in the electronic device and a trusted application to be installed in the electronic device; combining the normal application and the trusted application into an application package; and transmitting the application package to the electronic device.

1 is a block diagram illustrating a system for distributing trusted applications, according to one embodiment.
2 is a block diagram illustrating an internal structure of a processor in which a trusted application is installed, according to an exemplary embodiment.
3 and 4 are flowcharts illustrating a method of installing a trusted application, according to an embodiment.
5 is a block diagram illustrating an apparatus for distributing a trusted application to an electronic device, according to an embodiment.
6 is a block diagram illustrating an application package including a plurality of trusted applications of different types, according to an exemplary embodiment.
7 is a block diagram illustrating a system including paired electronic devices, according to one embodiment.
8 is a flowchart illustrating a method of transmitting a trusted application to another electronic device paired with the electronic device, according to an embodiment.
9 is a flowchart illustrating a method of distributing an application package including a trusted application, according to an embodiment.
10 is a block diagram illustrating an electronic device on which an application is installed, according to an exemplary embodiment.

Hereinafter, embodiments of the present disclosure will be described in detail so that those skilled in the art can easily practice them with reference to the accompanying drawings. However, the present disclosure may be embodied in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly describe the present disclosure in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

The terminology used in the present disclosure has been described as a general term currently used in consideration of the functions mentioned in the present disclosure, but it may mean various other terms depending on the intention or precedent of a person skilled in the art, the emergence of new technologies, and the like. can Therefore, the terms used in the present disclosure should not be interpreted only as the names of the terms, but should be interpreted based on the meanings of the terms and the contents throughout the present disclosure.

Also, terms such as first and second may be used to describe various elements, but elements should not be limited by these terms. These terms are used to distinguish one component from another.

Also, terms used in the present disclosure are only used to describe specific embodiments and are not intended to limit the present disclosure. Expressions in the singular number include the plural meaning unless the context clearly indicates the singular number. In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated. As used in this specification, particularly in the claims, "the" and similar designations may refer to both the singular and the plural. Further, unless there is a description that explicitly specifies the order of steps in describing a method according to the present disclosure, the recited steps may be performed in any suitable order. The present disclosure is not limited by the order of description of the described steps.

The appearances of the phrases “in some embodiments” or “in one embodiment” in various places in this specification are not necessarily all referring to the same embodiment.

Some embodiments of the present disclosure may be represented as functional block structures and various processing steps. Some or all of these functional blocks may be implemented as a varying number of hardware and/or software components that perform specific functions. For example, functional blocks of the present disclosure may be implemented by one or more microprocessors or circuit configurations for a predetermined function. Also, for example, the functional blocks of this disclosure may be implemented in various programming or scripting languages. Functional blocks may be implemented as an algorithm running on one or more processors. In addition, the present disclosure may employ prior art for electronic environment setting, signal processing, and/or data processing. Terms such as "mechanism", "element", "means" and "component" may be used broadly and are not limited to mechanical and physical components.

In addition, connecting lines or connecting members between components shown in the drawings are only examples of functional connections and/or physical or circuit connections. In an actual device, connections between components may be represented by various functional connections, physical connections, or circuit connections that can be replaced or added.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a system for distributing trusted applications, according to one embodiment.

Referring to FIG. 1 , a system for distributing trusted applications includes an electronic device 100 , an application distribution service apparatus 110 and a network 120 .

The application distribution service device 110 may transmit an application package for installing the application to the electronic device to at least one electronic device 100 through the network 120 . The application distribution service device 110 may transmit an application package to the electronic device 100 according to a request of the electronic device 100 .

The electronic device 100 includes a processor 101 , a network interface 102 for connecting to a network and a memory 103 for storing a computer program executable by the processor 101 . The processor 101 may include at least one of a rich OS environment 101a and a Trusted Execution Environment (TEE) 101b shown in FIG. 2 . The rich OS environment 101a and the trusted execution environment 101b may provide an environment in which normal applications and trusted applications can be executed. Hereinafter, an application installed in the rich OS environment 101a will be referred to as a normal application.

The memory 103 may include a computer-readable recording medium. The memory 103 of the electronic device 100 includes an application manager 104 and a trusted application installation service unit 105 . In one embodiment, the application manager 104 and the trusted application installation service unit 105 may be software programs stored in the memory 103 . Also, the application manager 104 and the trusted application installation service unit 105 may be embedded in the electronic device 100 .

The application manager 104 may obtain an application package from the application distribution service device 110 . The application package may include a normal application that can be installed in the rich OS environment 101a.

The trusted application installation service unit 105 may check whether the application package obtained from the application distribution service device 110 includes a trusted application. When the application package includes a trusted application, the trusted application installation service unit 105 may extract the trusted application from the application package and install the trusted application in the trusted execution environment 101b.

The trusted application installation service unit 105 may be pre-installed in the electronic device 100 by the manufacturer of the electronic device 100 . Accordingly, the trusted application installation service unit 105 may be provided in the electronic device 100 to adapt to the architecture of the trusted execution environment 101b. The trusted application installation service unit 105 may extract a trusted application from an application package and install the trusted application. Accordingly, according to an embodiment, a separate server-based system for distributing and managing trusted applications to a plurality of electronic devices 100 may not be required.

2 is a block diagram illustrating an internal structure of a processor in which a trusted application is installed, according to an exemplary embodiment.

Referring to FIG. 2 , the processor 101 of the electronic device 100 may include at least one of a rich OS environment 101a and a trusted execution environment 101b in which normal applications and trusted applications may be installed and executed, respectively. can

In the rich OS environment 101a, normal applications may be executed on an operating system (OS). The rich OS environment 101a may include an operating system in which conventional normal applications of the electronic device 100 may be executed. Normal applications running in the rich OS environment 101a may be isolated from each other and executed by the operating system. Thus, normal applications can be protected against external attacks. However, since the operating system of the rich OS environment 101a does not have a relatively high level of security, there is a possibility that the operating system of the rich OS environment 101a may be contaminated by malware. Since the security level of the application is dependent on the underlying operating system, if the operating system of the rich OS environment 101a is compromised, there is a high possibility that the normal application will also be compromised. Accordingly, in the rich OS environment 101a, processes for handling data for which security is relatively unimportant may be performed by normal applications.

In the trusted execution environment (TEE, 101b), a trusted application may be executed on a secure operating system (OS). The secure operating system may further include additional security functions and strongly control external access to the trusted execution environment. The trusted execution environment 101b may provide an isolated environment in which trusted applications can be executed by including a secure operating system.

The rich OS environment 101a and the trusted execution environment 101b may be separate operating system environments that run in parallel. As the data flow between the rich OS environment 101a and the trusted execution environment 101b is strictly controlled, data in the trusted execution environment 101b can be protected. Compared to the rich OS environment 101a, external access to the trusted execution environment 101b may be strictly limited to protect data processed in the trusted execution environment 101b.

The trusted application may be called and executed by one or more normal applications operated in the operating system of the rich OS environment 101a. For example, the mobile banking application may access the trusted application and request processing of sensitive and important data, such as the user's private information.

3 and 4 are flowcharts illustrating a method of installing a trusted application, according to an embodiment.

Referring to FIG. 3 , in step S310 , the electronic device 100 may acquire an application package for installing an application on the electronic device 100 through the network 120 . According to an embodiment, the application package may include a normal application installed in the rich OS environment 101a.

In step S320, the electronic device 100 may determine whether the application package obtained in step S310 includes a trusted application. For example, the electronic device 100 may determine whether an application package includes a trusted application based on a flag value indicating whether a trusted application is included. Flags can be included in application packages. According to an embodiment, regardless of whether the application package includes a trusted application, the electronic device 100 may install a normal application in the rich OS environment 101a using the application package.

In operation S330 , when the application package includes a trusted application, the electronic device 100 may extract the trusted application from the application package and install it in the electronic device 100 . For example, a trusted application may be installed in a secure area of the electronic device 100 . The security area of the electronic device 100 may provide a high-security environment to trusted applications. For example, the secure domain may include the trusted execution environment 101b. The trusted execution environment 101b can provide a trusted application with a high-security environment by strictly restricting external access. By being installed in a secure area, a trusted application can perform an operation of processing sensitive and important data in a high-security environment.

Referring to FIG. 4 , an exemplary embodiment of a method of installing a trusted application will be further described.

Referring to FIG. 4 , in step S410 , the electronic device 100 may acquire an application package for installing an application on the electronic device 100 through the network 120 .

For example, the electronic device 100 may access an app store provided by the application distribution service device 110 . The app store may provide the electronic device 100 with at least one of information about applications installed in the electronic device 100 and information about new applications that may be installed in the electronic device 100 . When an application to be installed in the electronic device 100 is selected, the electronic device 100 may download an application package for installing the selected application in the electronic device 100 through an app store.

In step S420, the electronic device 100 may install a normal application in the rich OS environment 101a using the application package.

In step S430, if the normal application is installed in the rich OS environment 101a, the electronic device 100 may recognize that a new application is installed in the rich OS environment 101a. For example, the electronic device 100 may use 'New App Installed' ("android.intent.action.PACKAGE_ADDED"), which is an event notification indicating that a new application is installed. 'New App Installed' ("android.intent.action.PACKAGE_ADDED") may be used by the electronic device 100 to recognize that a new application is installed. The event notification described above is only an example, and different types of event notifications may be used depending on the type of operating system used in the electronic device 100 .

In step S440, in response to the event notification indicating that a new application is installed, the electronic device 100 may determine whether an application package of a new application installed in the rich OS environment 101a includes a trusted application. For example, the electronic device 100 may determine whether the application package includes a trusted application based on a flag value indicating whether the application package includes a trusted application. In one embodiment, when the application package does not include the trusted application, the installation of the trusted application is not necessary, and thus the installation of the application may be terminated.

In step S450, when the application package includes trusted applications, the electronic device 100 may determine whether a plurality of trusted applications are included in the application package. For example, the electronic device 100 may determine whether a plurality of trusted applications are included in the application package based on identification information representing trusted applications included in the application package.

An application package according to an embodiment may include a plurality of trusted applications that may be installed in different types of trusted execution environments 101b or different types of electronic devices 100 . Different types of trusted execution environments may be provided by different vendors or may be of different versions from the same vendor. The electronic device 100 may extract a trusted application that may be installed in the trusted execution environment 101b of the electronic device 100 from among a plurality of trusted applications from an application package. And, the electronic device 100 may install the extracted trusted application in the trusted execution environment 101b.

In step S460, when the application package includes a plurality of trusted applications, the electronic device 100 may select a trusted application that can be installed in the trusted execution environment 101b where the trusted application is to be installed. For example, the electronic device 100 may select a trusted application that can be installed and executed in the trusted execution environment 101b from among a plurality of trusted applications.

In one embodiment, when different types of trusted execution environments 101b exist in the electronic device 100, the electronic device 100 provides a trusted application that can be installed in each trusted execution environment 101b. You can select multiple.

In step S470, the electronic device 100 may extract the trusted application selected in step S460 from the application package and install the trusted application in the trusted execution environment 101b.

According to an embodiment, the trusted application may be installed after the normal application is installed in the rich OS environment 101a or before the normal application is installed in the rich OS environment 101a. Also, in the rich OS environment 101a, normal applications and trusted applications may be installed in parallel.

However, when a system notification notifying that a new application is installed is activated when a new application is installed, the trusted application is preferably installed after the application is installed in the rich OS environment 101a. This is because the electronic device 100 can recognize that a new application is installed by the system notification and install the trusted application.

Meanwhile, when the application package includes only one trusted application, the electronic device 100 may install the trusted application included in the application package into the trusted execution environment 101b. However, when the trusted application installation service unit 105 cannot install the trusted application in the trusted execution environment 101b, it may end the process of installing the trusted application without installing the trusted application. For example, when the type of the trusted application and the type of the trusted execution environment 101b are different, the trusted application installation service unit 105 terminates the process of installing the trusted application without installing the trusted application. can

5 is a block diagram illustrating an apparatus for distributing a trusted application to an electronic device, according to an embodiment.

The device shown in FIG. 5 may be included in an embodiment of the application distribution service device 110 of FIG. 1 . The application distribution service device 110 includes an application package generating unit 111 that combines at least one of a flag 114, a normal application 115, and a trusted application 116 to generate an application package 113. do.

For example, the application package generating unit 111 may generate the application package 113 using a software development kit based on a predetermined operating system. A software development kit is a set of development tools that allows you to create applications for a hardware platform, computer system, operating system, etc. The application package creation unit 111 may create an application package 113 that can be installed in the operating system installed in the electronic device 100 by using a software development kit.

The application package generating unit 111 may generate the application package 113 including the trusted application 116 so that the trusted application 116 may be installed in the electronic device 100 together with the normal application 115. there is. The application package generator 111 may set a state of the flag 114 to indicate whether the application package 113 includes the trusted application 116 . For example, the flag 114 may be set to 'TRUE' if the trusted application 116 is included or set to 'FALSE' if the trusted application 116 is not included.

For example, for compatibility with the meta data structure of the application package 113, the flag 114 may be defined using custom android permission information. Custom Android permission information is an option for setting permissions required when a predetermined activity is executed. Existence of the aforementioned authority information may be checked by the electronic device 100 . In addition, the authority information may be used to indicate the presence or absence of the trusted application 116 for the application package 113 . Authorization information may appear as a sentence (eg "com.samsung.sec.TA_EXISTS"). Authorization information may be stored in a manifest file including information related to normal applications. Without being limited to the examples described above, the flag 114 may be defined in the application package 113 in a variety of ways. In addition, information indicating whether the application package 113 includes the trusted application 116 may be included in the application package 113 in various types of information as well as the flag 144 .

The electronic device 100 can determine whether the application package 113 includes the trusted application 116 by checking the state of the flag 114 . When the value of the flag 114 is 'TRUE', the electronic device 100 may perform a process for installing the trusted application 116 .

Also, an authentication token for managing a trusted execution environment may be embedded in the application package 113 . Thus, various management functions for the trusted application 116 on the electronic device 100 may be supported by the authentication token (eg, trusted application deletion, update, and status update). The authentication token electronically represents an authenticated command issued by a subject having authority associated with the trusted application 116 or trusted execution environment of the electronic device 100, such as a vendor of the trusted execution environment or a secure domain owner. It is signed binary data.

As described above, the flag 114 may signal the existence and non-existence of the trusted application 116 . Without being limited thereto, the existence and non-existence of the trusted application 116 indicates the presence or absence of the trusted application 116 by including a suffix, eg ".TA PKG", which is a signal indicating whether or not the trusted application 116 exists. can be signaled through

The application distribution service device 110 may include an application distribution unit 112 that transmits the application package 113 to the electronic device 100 . The application distribution unit 112 may transmit the application package 113 generated by the application package creation unit 111 to the electronic device 100 . The application distribution unit 112 may transmit the application package 113 to the electronic device 100 according to the request of the electronic device 100 .

6 is a block diagram illustrating an application package including a plurality of trusted applications of different types, according to an exemplary embodiment.

Referring to FIG. 6 , an application package 600 may include a flag 610 , a normal application 620 and a plurality of trusted applications 630 and 640 . The flag 610 may include information about whether the application package 600 includes a trusted application. Each of the trusted applications 630 and 640 may correspond to a type 1 trusted execution environment 101b and a type 2 trusted execution environment 101b. Alternatively, each of the trusted applications 630 and 640 may correspond to the type 1 and type 2 electronic device 100 , respectively.

An application developer may provide the same application package 600 to different types of electronic devices 100 . Different types of electronic devices 100 may include different types of trusted execution environments 101b. The application package 600 may include a plurality of trusted applications 630 and 640 that may be installed in different types of the trusted execution environment 101b. Accordingly, one application package 600 may be provided to the electronic devices 100 . In one embodiment, the electronic device 100 extracts the trusted applications 630 and 640 matching the type of the electronic device 100 from the application package 600 and the trusted execution environment 101b of the electronic device 100 . ) can be installed.

7 is a block diagram illustrating a system including paired electronic devices, according to one embodiment.

Referring to FIG. 7 , a mobile electronic device 720 such as a smart phone may be paired with a wearable electronic device 710 such as a smart watch. Various types of electronic devices may be paired with each other, not limited to the wearable electronic device 710 and the mobile electronic device 720 .

In the following description, the second application package may refer to an application package included in the first application package. The third application package may refer to an application package included in the second application package.

According to an embodiment, the first application package may be an application package that is directly connected to a network or may be installed in an electronic device used as a main device. Also, the second application package may be an application package that is not directly connected to a network but may be installed in an electronic device connected to a network through another electronic device or used as an auxiliary device. In addition, the electronic devices on which the first application package and the second application package can be respectively installed may be connected to each other through wired or wireless or paired devices. The second application package may be installed in a type of electronic device capable of being connected or paired with an electronic device of a type in which the first application package may be installed.

The second application packages 723 and 726 may be included in the first application package 721, and the second application packages 723 and 726 may include another application package, for example, a third application package. The second application package 723 may be installed in the type 1 wearable electronic device 710 paired with the mobile electronic device 720 . The second application package may include at least one of a normal application 724 and a trusted application 725 that may be installed on the wearable electronic device 710 .

The third application package that can be included in the second application packages 723 and 726 can be installed in a type of electronic device that can be paired with or connected to an electronic device in which the second application packages 723 and 726 can be installed. there is. The application package may include application packages that can be repeatedly installed in other electronic devices as in the above-described embodiment.

The mobile electronic device 720 extracts the normal application 729 and the trusted application 730 from the first application package 721, and extracts the normal application 729 and the trusted application 730 from the rich OS environment 731. and the trusted execution environment 732, respectively. Based on the value of the flag 722, the mobile electronic device 720 determines whether a trusted application 730 exists in the first application package 721, and provides the trusted application 730 to the mobile electronic device 720. can be installed

In addition, the first application package 721 may further include a second application package 723 for the type 1 wearable electronic device 710 and an application package 726 for the type 2 wearable electronic device. Different types of wearable electronic devices may include different operating systems or different trusted execution environments. The application package 723 for a type 1 wearable electronic device and the application package 726 for a type 2 wearable electronic device are normal applications 724 and 727 that can be installed on different operating systems and different trusted execution environments. It may include at least one of the trusted applications 725 and 728 that may be installed. For example, the first application package 721 acquired by the mobile electronic device 720 may include an Android package for Android Wear smart work or a widget for Samsung Gear smart watch as a second application package. there is.

Each of the second application packages 723 and 726 may further include flags 741 and 742 indicating whether the trusted applications 725 and 728 are included. The electronic device in which the second application packages 723 and 726 are installed may use the flags 741 and 742 to determine whether the trusted applications 725 and 728 exist.

The mobile electronic device 720 may extract the second application package 723 , which may be installed on the type 1 wearable electronic device 710 , from the first application package 721 . And, the mobile electronic device 720 may transmit the second application package 723 to the type 1 wearable electronic device 710 . As shown in FIG. 7 , the type 1 trusted application 725 included in the second application package 723 may be installed in the type 1 trusted execution environment 715 of the wearable electronic device 710. . The second application package 723 may further include a type 1 normal application 724 to be installed in the rich OS environment 714 of the wearable electronic device 710 . According to an embodiment, the second application package 723 may include at least one of a type 1 normal application 725 and a trusted application 725 that may be installed in the type 1 wearable electronic device 710. there is.

At least one of the normal application 724 and the trusted application 725 included in the second application package 723 may be related to the normal application 729 or the trusted application 730 installed in the mobile electronic device 720. there is. For example, the second application package 723 includes at least one of a type 1 normal application 724 and a trusted application 725 that can be executed in association with the normal application 729 installed on the mobile electronic device 720. can include

8 is a flowchart illustrating a method of transmitting a trusted application to another electronic device paired with the electronic device, according to an embodiment.

Referring to FIG. 8 , in step S810, the electronic device may obtain a first application package. An electronic device and another electronic device may be paired or wired or wirelessly connected to each other.

In operation S820, the electronic device may determine a second application package to be transmitted to another electronic device from among one or more second application packages included in the first application package. The second application package may be determined according to whether applications of the second application package can be installed in other electronic devices.

At least one of a normal application and a trusted application included in the second application package may be installed in another electronic device that has received the second application package. Other electronic devices may install the trusted application based on the flag included in the second application package.

According to an embodiment, a first application package for a mobile electronic device may include one or more second application packages for wearable electronic devices of different types. When a wearable electronic device of one specific type is paired with a mobile electronic device, a second application package that can be installed in the paired wearable electronic device may be selected. The second application package may be transmitted to the paired wearable electronic device.

In step S830, the electronic device may extract the second application package determined in step S820 to be transmitted to another electronic device from the first application package.

In step S840, the extracted second application package may be transmitted to another electronic device. The second application package may include at least one of a normal application that can be installed in a rich OS environment and a trusted application that can be installed in a trusted execution environment. In addition, the second application package may further include a flag indicating whether a trusted application is included. As another example, the trusted application may be extracted by the electronic device itself and transmitted to another paired electronic device without being included in the second application package.

The second application package transmitted to the other paired electronic device may include one or more third application packages. The other paired electronic device may extract the third application package from the second application package and transmit the third application package to an electronic device where an application of the third application package is to be installed. The electronic device on which the third application package is installed may be another electronic device paired with the electronic device in which the application of the second application package is installed.

9 is a flowchart illustrating a method of distributing an application including a trusted application, according to an embodiment.

Referring to FIG. 9 , in step S910, the application distributing device may obtain a normal application to be installed in the electronic device and a trusted application to be installed in a secure area of the electronic device.

In step S920, the application distributing device may combine the normal application and the trusted application into an application package. The application package may further include a flag indicating whether a trusted application is included. The application package may include a plurality of trusted applications corresponding to a plurality of trusted execution environment types.

In step S930, the device may transmit the application package to the electronic device where the application is to be installed. The device may transmit the application package to the electronic device according to a request of the electronic device.

10 is a block diagram illustrating an electronic device on which an application is installed, according to an exemplary embodiment.

Referring to FIG. 10 , an electronic device 1000 may include, for example, a network interface 1010 and a processor 1020.

The network interface 1010 may acquire an application package for installing an application through an external network. The application package may be provided to the electronic device 1000 through an app store providing application packages that can be installed in the electronic device 1000 .

The processor 1020 may extract a trusted application from an application package obtained through the network interface 1010 and install the trusted application in a secure area of the electronic device 1000 . In one embodiment, the security area of the electronic device 1000 may include a trusted execution environment in which external access is restricted. Trusted applications can work with sensitive and important data. A trusted application can perform tasks at a high security level by being executed in a trusted execution environment.

According to an embodiment, a trusted application may be distributed to one or more electronic devices using an application package without necessarily having a server-based system for distributing the trusted application to one or more electronic devices.

Meanwhile, the above-described embodiment can be written as a program that can be executed on a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable medium. In addition, the structure of data used in the above-described embodiment can be recorded on a computer readable medium through various means. In addition, the above-described embodiments may be implemented in the form of a recording medium including instructions executable by a computer, such as program modules executed by a computer. For example, methods implemented as software modules or algorithms may be stored in a computer-readable recording medium as codes or program instructions that can be read and executed by a computer.

Computer readable media may be any recording media that can be accessed by a computer, and may include volatile and nonvolatile media, removable and non-removable media. The computer readable medium may include a magnetic storage medium, for example, a ROM, a floppy disk, a hard disk, etc., and) an optical reading medium, for example, a CD-ROM, a DVD, and the like. don't Also, computer readable media may include computer storage media and communication media.

In addition, a plurality of computer-readable recording media may be distributed among computer systems connected by a network, and data stored on the distributed recording media, for example, program instructions and codes, may be executed by at least one computer. there is.

The specific implementations described in this disclosure are only one example and do not limit the scope of the disclosure in any way. For brevity of the specification, a description of conventional electronic components, control systems, software, and other functional aspects of the systems may be omitted.

Terms such as "unit" and "module" described in this specification refer to a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software.

"Unit" and "module" may be implemented by a program stored in an addressable storage medium and executed by a processor.

For example, "part" and "module" can refer to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and programs. It can be implemented by procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables.

Claims (15)

In an electronic device, a method of installing an application,
obtaining an application package for installing the application, including a flag, the application, and a plurality of trusted applications;
identifying whether the application package includes a first trusted application that can be installed in the electronic device, based on the flag indicating whether the application package includes a trusted application; and
When the application package includes the first trusted application, installing the first trusted application in the electronic device;
identifying whether the application package includes a second trusted application installable in another electronic device, based on the flag included in the application package; and
If the application package includes the second trusted application, further comprising transmitting the second trusted application to the other electronic device;
The flag determines whether or not an application trusted in the execution environment of the electronic device exists among the plurality of trusted applications included in the application package and the execution of the other electronic device among the plurality of trusted applications included in the application package. A method that indicates whether a trusted application exists in the environment. delete According to claim 1,
extracting a second application package that can be installed in the other electronic device from the application package; and
Further comprising transmitting the extracted second application package to the other electronic device. The method of claim 1, wherein the other electronic device
A method comprising a wearable electronic device paired with the electronic device. The method of claim 1, wherein the installing step
When the application package includes a plurality of trusted applications corresponding to different types of security areas, selecting a trusted application that can be installed in the security area of the electronic device based on the type of the electronic device. step;
and installing the selected trusted application in a secure area of the electronic device. delete In an electronic device in which an application is installed,
a network interface for obtaining an application package for installing the application, including a flag, the application, and a plurality of trusted applications; and
Identifying whether the application package includes a first trusted application that can be installed in the electronic device based on the flag indicating whether the application package includes a trusted application; a processor to install the first trusted application in the electronic device when the application package includes the first trusted application;
The processor identifies whether the application package includes a second trusted application installable in another electronic device based on the flag included in the application package;
If the application package includes the second trusted application, control the network interface to transmit the second trusted application to the other electronic device;
The flag determines whether or not an application trusted in the execution environment of the electronic device exists among the plurality of trusted applications included in the application package and the execution of the other electronic device among the plurality of trusted applications included in the application package. An electronic device that indicates whether a trusted application exists in the environment. delete The method of claim 7, wherein the processor
Extracting a second application package that can be installed in the other electronic device from the application package;
Controlling the network interface to transmit the extracted second application package to the other electronic device. The method of claim 7, wherein the other electronic device
An electronic device comprising a wearable electronic device paired with the electronic device. The method of claim 7, wherein the processor
When the application package includes a plurality of trusted applications corresponding to different types of security areas, based on the type of the electronic device, a trusted application that can be installed in the security area of the electronic device is selected; , Installing the selected trusted application in the secure area of the electronic device.
delete delete delete delete

Images